feat(proxy): support managed wildcard host routes

[vishr]

Summary

• add an explicit wildcard_suffix HTTP route contract rendered with Traefik v3.7's native single-label Host wildcard
• validate exact and wildcard hostnames, reject catch-alls and ambiguous host shapes, and reject overlapping exact/wildcard claims instead of relying on implicit router priority
• add managed ACME DNS-01 configuration through proxy.dns_challenge, with provider credentials isolated in proxy.config/.env
• preserve custom static Traefik configurations while verifying that wildcard-terminating routes actually use DNS-01
• update the published schema, generated field reference, and project-file documentation

Verification

• just ci
• ob validate and ob preview against a project containing exact and wildcard routes; preview emitted the expected native wildcard Host rule
• diff-only gitleaks scan

Closes #197